After recovering the partition with e2fsck -f -b 32768, I've noticed that the oldest files on the disk were mostly preserved, and that most of the unrecovered files were the newest files, and thus without backups.

Is the property of losing the newest files and preserving the oldest files intrinsic to ext4, or was this just bad luck? Are there any file systems which, upon corruption, tend to lose the older files and to preserve the newer ones?

Came here from your original post; disappointed to see there's no answer yet. I'm in a very similar boat!
– EnemyBagJonesAug 4 '17 at 14:56

How old is "old" and how new is "new"?
– Kusalananda♦Nov 27 '17 at 11:16

If it's an I/O error from the drive itself, it probably has nothing to do with the file system. And if there just so happens to be a section of the drive that is faulty and unuseable, you'd see it when you try to use it, i.e. with newer files...
– ilkkachuNov 27 '17 at 11:16

1

@Kusalananda: The "old" files are the files that have been on the disk the most amount of time. In my specific case, it was probably about 2-3 years. The "new" files are files that have been on the disk the least amount of time, less than three months.
– dotancohenNov 27 '17 at 11:19

3

If your drive or filesystem develops a problem writing (but not reading), you see it on the parts you write after the problem shows up. So 1) check your drive for errors (smartmontools) and 2) if SMART is OK then check the filesystem (fsck).
– xenoidNov 27 '17 at 11:34

1 Answer
1

The superblock on your filesystem had become unreadable. The superblock is the most important block, because it contains the information how the filesystem is set up.

All newer filesystem use a so-called journal: new or changed blocks are written to some contigous area first, and eventually replace the blocks in the "normal" area. This makes recovery easier: the recovery program looks at the journal, checks what transactions were complete before the failure, and then can restore the filesystem to a consistent state from the last successful transaction. This also means that the newest changes are lost after a recovery, but usually these are only small changes.

It's difficult to say what happened in your case because you didn't give information about how the recovery process went. The filesystem contains copies of the superblock, so you should have been able to use a copy instead of the corrupted one, access the journal from the copy, and restore the filesystem to nearly the same state you had before the problem.

As you said you lost quite a few newer files, my guess is that the recovery program either couldn't restore the superblock, and therefore made some assumptions, and because of that or because of some other reason couldn't find the journal, so you lost all changes in the journal, instead of just the last incomplete transaction.

In general, newer filesystem like ext4 are better at recovery (possibly with some manual input during recovery) than older filesystems like ext2 or FAT. If these get corrupted, you loose whatever was corrupted. In journaled filesystems, it's nearly always possible to move back to some consistent state that's not too far away from the state when the problem occured. So the answer to the question in the subject is "not at all, quite the contrary".

You can use mount options to influence how often and in what way the journal is written and transactions are commited, so you can trade increased recovery chances for performance.